{"investigation":{"slug":"dolomite","entity_name":"Dolomite","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Dolomite is a decentralized money market and trading protocol originally launched on Ethereum in 2019 and migrated to Arbitrum in 2022. The protocol suffered a $1.8 million exploit in March 2024 due to a reentrancy vulnerability in a legacy 2019 Ethereum contract. The platform drew significant controversy in 2026 when Trump-affiliated World Liberty Financial (WLFI) used 5 billion WLFI tokens as collateral to borrow $75 million on Dolomite — a platform co-founded by WLFI's own chief technology officer — driving USD1 pool utilization to 93% and trapping ordinary depositors.","sections":[{"content":"Dolomite is a decentralized money market and DEX protocol that combines lending, borrowing, and margin trading into a single capital-efficient interface. It was originally deployed on Ethereum in 2019 and migrated to Arbitrum One in October 2022. The protocol has since expanded to Polygon zkEVM, Mantle, Berachain, and other networks. The platform is powered by the DOLO token, which launched via TGE on April 24, 2025, with 20% of total supply distributed to users via airdrop. Co-founders Corey Caplan and Adam Knuckey have led the project since inception; Caplan has been an Ethereum developer since 2017. As of early 2026, Dolomite reported over $835 million in total value locked, largely inflated by WLFI collateral deposits.","heading":"Protocol Overview","sources":[{"url":"https://dolomite.io/","name":"dolomite.io","type":"other","credibility":3},{"url":"https://docs.dolomite.io/","name":"docs.dolomite.io","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/dolomite/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/314203/dolomite-co-founder-corey-caplan-takes-advisor-role-at-trump-backed-world-liberty-financial","name":"theblock.co","type":"other","credibility":3},{"url":"https://chainwire.org/2025/04/24/dolomite-to-launch-tge-with-dolo-token/","name":"chainwire.org","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 20, 2024, Dolomite's legacy Ethereum smart contract — deployed in 2019 and officially deprecated when the team migrated to Arbitrum — was exploited for approximately $1.8 million in USDC. The vulnerable contract contained a function named 'callFunction' that permitted arbitrary calls. Although guarded by a 'noEntry' reentrancy modifier, the guard could be bypassed by the TradeManager contract at address 0xe2466, which contained a separate 'call' function lacking any reentrancy protection. Attackers used this bypass to drain funds from users who had never revoked their legacy token approvals to the deprecated Ethereum contract. The attacker moved all stolen funds through Tornado Cash to obscure the trail. Dolomite's team disabled the faulty contract after the breach and advised users to revoke approvals to the Ethereum address beginning with 0xe2466. Users interacting exclusively with the Arbitrum version were reportedly unaffected.","heading":"March 2024 Smart Contract Exploit ($1.8 Million)","sources":[{"url":"https://cointelegraph.com/news/old-dolomite-exchange-contract-suffers-1-8-million-loss-from-approval-exploit","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/dolomite-exchange-hack","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://revoke.cash/exploits/dolomite","name":"revoke.cash","type":"other","credibility":3},{"url":"https://cryptobriefing.com/dolomite-security-exploit-theft/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2024","name":"halborn.com","type":"other","credibility":3},{"url":"https://cryptodaily.co.uk/2024/03/dolomite-exchange-breach-hacker-pilfers-18m-in-usdc","name":"cryptodaily.co.uk","type":"other","credibility":3}],"severity":"medium"},{"content":"In a significant conflict-of-interest situation reported in April 2026, World Liberty Financial (WLFI) — a Trump family-affiliated crypto venture — deposited 5 billion WLFI tokens as collateral on Dolomite to borrow approximately $75 million in stablecoins: $65.4 million in the WLFI-issued USD1 stablecoin and $10.3 million in USDC. The arrangement involved a direct insider relationship: Dolomite co-founder Corey Caplan also serves as WLFI's chief technology officer and adviser. WLFI accounted for approximately 55% of Dolomite's entire TVL at the time. The borrowing drove the USD1 lending pool to 93% utilization, effectively preventing ordinary depositors from withdrawing their stablecoins. Analysts warned that a sharp decline in WLFI's token price could trigger a liquidation cascade that would create bad debt and further harm retail depositors, as the collateral token trades with limited market depth. WLFI defended the position, calling criticism 'FUD' and describing the borrowing as a mechanism to 'jumpstart' Dolomite. Senator Elizabeth Warren formally urged the SEC on May 14, 2026 to investigate whether WLFI misled investors in connection with this transaction. The SEC had not announced a formal investigation as of late May 2026.","heading":"World Liberty Financial (WLFI) Conflict of Interest and Depositor Harm","sources":[{"url":"https://www.coindesk.com/markets/2026/04/09/trump-s-world-liberty-financial-borrows-usd75-million-against-its-own-token-trapping-depositors-on-dolomite","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2026/04/10/trump-backed-wlfi-token-drops-12-to-record-lows-after-team-defends-multi-million-lending-position","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2026/04/13/wlfi-mints-usd25-million-in-fresh-usd1-and-burns-usd3-million-days-after-repayment-claim","name":"coindesk.com","type":"other","credibility":3},{"url":"https://fortune.com/2026/04/10/trump-world-liberty-financial-crypto-tokens-insider-loans/","name":"fortune.com","type":"other","credibility":3},{"url":"https://www.banking.senate.gov/newsroom/minority/ahead-of-crypto-markup-warren-presses-sec-to-investigate-trump-family-crypto-firm-for-potentially-misleading-investors","name":"banking.senate.gov","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/05/15/senator-warren-urges-sec-to-probe-trump-backed-world-liberty-financial/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://financefeeds.com/wlfi-leverage-position-pushes-dolomite-protocol-to-liquidity-limit/","name":"financefeeds.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Dolomite was the subject of a community complaint on the Arbitrum Foundation forum alleging a 'tremendous violation' of the Short-Term Incentive Program (STIP) rules. The complaint alleged that Dolomite routed incentive grants through an 'oARB' (options-based ARB) mechanism that charged users fees to convert incentive tokens back to standard ARB, with critics alleging that only approximately 5% of incentives reached users as direct ARB rewards while the remainder accrued to the protocol treasury. The complaint was resolved after multisig intervention; Dolomite agreed to modify the mechanism to allow users to freely claim ARB rewards 1:1 with oARB if they staked for a maximum duration of 40 weeks. A subsequent community response noted the oARB mechanism had been disclosed in public proposals and voted on by delegates. The funding stream was not interrupted. The outcome suggests a transparency concern rather than a confirmed misappropriation.","heading":"Arbitrum STIP Funding Controversy (2023)","sources":[{"url":"https://forum.arbitrum.foundation/t/tremendous-violation-of-stip-rules-by-dolomite-and-umami/19739","name":"forum.arbitrum.foundation","type":"other","credibility":3},{"url":"https://forum.arbitrum.foundation/t/dolomite-final-stip-round-1/16818","name":"forum.arbitrum.foundation","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the April 2025 DOLO token generation event, scammers deployed a fraudulent 'Dolomite ($DOLO) Allocation Checker' site at the domain checker-dolomite[.]com — described as a near-identical copy of the legitimate dolomite.io website. The scam page falsely claims users can verify their DOLO airdrop eligibility. When a victim connects their wallet to the fraudulent page and signs the prompted transaction, a malicious contract facilitates automated fund transfers to attacker-controlled wallets. The funds cannot be recovered due to the irreversible nature of on-chain transactions. Dolomite itself is not responsible for this third-party phishing operation, though affected users should be aware of impersonation risks when searching for the protocol. The scam was documented by PC Risk and reported to security databases.","heading":"Phishing Scam: Fake DOLO Allocation Checker","sources":[{"url":"https://www.pcrisk.com/removal-guides/33668-dolomite-dolo-allocation-checker-scam","name":"pcrisk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Dolomite's smart contracts have undergone six independent security audits by Zeppelin Solutions, Bramah Systems, SECBIT Labs, Cyfrin, Zokyo, and Guardian Audits. The team maintains a bug bounty program rewarding responsible disclosures under the OWASP risk framework, and reports 100% line, statement, and branch test coverage on production contracts. The March 2024 exploit targeted a deprecated 2019 Ethereum contract, not audited Arbitrum code. As of early 2026, DOLO has lost approximately 91.5% of its value from its all-time high of $0.3671 reached in August 2025, with a market cap of approximately $15 million and a fully diluted valuation of $31 million.","heading":"Security Audits and Current Posture","sources":[{"url":"https://docs.dolomite.io/audits-and-security","name":"docs.dolomite.io","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/dolomite","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/dolomite/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2019","event":"Dolomite originally launched on Ethereum mainnet as a decentralized exchange; vulnerable legacy contract deployed.","source":"","date_original":"2019-01-01"},{"date":"2022-10","event":"Dolomite migrated to Arbitrum One, phasing out Ethereum version while legacy contracts remained active on-chain.","source":"","date_original":"2022-10-01"},{"date":"2023-11","event":"Arbitrum community filed complaint alleging Dolomite violated STIP program rules via oARB mechanism; resolved after multisig intervention and mechanism modification.","source":"","date_original":"2023-11-01"},{"date":"2024-03-20","event":"Dolomite's deprecated 2019 Ethereum contract exploited for approximately $1.8 million in USDC via reentrancy bypass through TradeManager contract; stolen funds moved through Tornado Cash.","source":""},{"date":"2025-01-06","event":"Snapshot taken for DOLO token airdrop eligibility.","source":""},{"date":"2025-08-31","event":"DOLO token reached all-time high of $0.3671.","source":""},{"date":"2025-09","event":"Dolomite co-founder Corey Caplan announced as adviser and CTO to World Liberty Financial (WLFI).","source":"","date_original":"2025-09-01"},{"date":"2026","event":"World Liberty Financial launched its DeFi lending market built on Dolomite infrastructure, boosting DOLO price temporarily.","source":"","date_original":"2026-01-01"},{"date":"2026-04-09","event":"CoinDesk reported WLFI deposited 5 billion WLFI tokens on Dolomite to borrow $75 million in stablecoins, driving USD1 pool utilization to 93% and trapping depositors.","source":""},{"date":"2026-04-10","event":"WLFI token dropped 12% to record lows; WLFI team publicly defended the position and dismissed liquidation concerns as 'FUD'.","source":""},{"date":"2026-04-13","event":"WLFI minted $25 million in fresh USD1 stablecoin amid ongoing Dolomite borrowing controversy.","source":""},{"date":"2026-05-14","event":"Senator Elizabeth Warren formally urged SEC Chairman Paul Atkins to investigate whether WLFI misled investors in connection with Dolomite borrowing arrangement.","source":""}],"sources_used":[{"url":"https://dolomite.io/","name":"dolomite.io","type":"other","archive_url":"http://web.archive.org/web/20260708061722/https://dolomite.io/","credibility":3,"archive_timestamp":"2026-07-08T06:17:22+00:00"},{"url":"https://docs.dolomite.io/","name":"docs.dolomite.io","type":"other","archive_url":"http://web.archive.org/web/20260708061753/https://docs.dolomite.io/","credibility":3,"archive_timestamp":"2026-07-08T06:17:53+00:00"},{"url":"https://coinmarketcap.com/currencies/dolomite/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260523041056/https://coinmarketcap.com/currencies/dolomite/","credibility":3,"archive_timestamp":"2026-05-23T04:10:56+00:00"},{"url":"https://www.theblock.co/post/314203/dolomite-co-founder-corey-caplan-takes-advisor-role-at-trump-backed-world-liberty-financial","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260311075236/https://www.theblock.co/post/314203/dolomite-co-founder-corey-caplan-takes-advisor-role-at-trump-backed-world-liberty-financial","credibility":3,"archive_timestamp":"2026-03-11T07:52:36+00:00"},{"url":"https://chainwire.org/2025/04/24/dolomite-to-launch-tge-with-dolo-token/","name":"chainwire.org","type":"other","archive_url":"http://web.archive.org/web/20260206201321/https://chainwire.org/2025/04/24/dolomite-to-launch-tge-with-dolo-token/","credibility":3,"archive_timestamp":"2026-02-06T20:13:21+00:00"},{"url":"https://cointelegraph.com/news/old-dolomite-exchange-contract-suffers-1-8-million-loss-from-approval-exploit","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260720150425/https://cointelegraph.com/news/old-dolomite-exchange-contract-suffers-1-8-million-loss-from-approval-exploit","credibility":3,"archive_timestamp":"2026-07-20T15:04:25+00:00"},{"url":"https://www.web3isgoinggreat.com/single/dolomite-exchange-hack","name":"web3isgoinggreat.com","type":"other","archive_url":"https://web.archive.org/web/20260830011142/https://www.web3isgoinggreat.com/single/dolomite-exchange-hack","credibility":3,"archive_timestamp":"2026-08-30T01:11:42+00:00"},{"url":"https://revoke.cash/exploits/dolomite","name":"revoke.cash","type":"other","archive_url":"http://web.archive.org/web/20260416232644/https://revoke.cash/exploits/dolomite","credibility":3,"archive_timestamp":"2026-04-16T23:26:44+00:00"},{"url":"https://cryptobriefing.com/dolomite-security-exploit-theft/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20260218153739/https://cryptobriefing.com/dolomite-security-exploit-theft/","credibility":3,"archive_timestamp":"2026-02-18T15:37:39+00:00"},{"url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2024","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260609202026/https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2024","credibility":3,"archive_timestamp":"2026-06-09T20:20:26+00:00"},{"url":"https://cryptodaily.co.uk/2024/03/dolomite-exchange-breach-hacker-pilfers-18m-in-usdc","name":"cryptodaily.co.uk","type":"other","archive_url":"https://web.archive.org/web/20260829182957/https://cryptodaily.co.uk/2024/03/dolomite-exchange-breach-hacker-pilfers-18m-in-usdc","credibility":3,"archive_timestamp":"2026-08-29T18:29:57+00:00"},{"url":"https://www.coindesk.com/markets/2026/04/09/trump-s-world-liberty-financial-borrows-usd75-million-against-its-own-token-trapping-depositors-on-dolomite","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260729163302/https://www.coindesk.com/markets/2026/04/09/trump-s-world-liberty-financial-borrows-usd75-million-against-its-own-token-trapping-depositors-on-dolomite","credibility":3,"archive_timestamp":"2026-07-29T16:33:02+00:00"},{"url":"https://www.coindesk.com/markets/2026/04/10/trump-backed-wlfi-token-drops-12-to-record-lows-after-team-defends-multi-million-lending-position","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260412072528/https://www.coindesk.com/markets/2026/04/10/trump-backed-wlfi-token-drops-12-to-record-lows-after-team-defends-multi-million-lending-position","credibility":3,"archive_timestamp":"2026-04-12T07:25:28+00:00"},{"url":"https://www.coindesk.com/markets/2026/04/13/wlfi-mints-usd25-million-in-fresh-usd1-and-burns-usd3-million-days-after-repayment-claim","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260602143649/https://www.coindesk.com/markets/2026/04/13/wlfi-mints-usd25-million-in-fresh-usd1-and-burns-usd3-million-days-after-repayment-claim","credibility":3,"archive_timestamp":"2026-06-02T14:36:49+00:00"},{"url":"https://fortune.com/2026/04/10/trump-world-liberty-financial-crypto-tokens-insider-loans/","name":"fortune.com","type":"other","archive_url":"http://web.archive.org/web/20260414022639/https://fortune.com/2026/04/10/trump-world-liberty-financial-crypto-tokens-insider-loans/","credibility":3,"archive_timestamp":"2026-04-14T02:26:39+00:00"},{"url":"https://www.banking.senate.gov/newsroom/minority/ahead-of-crypto-markup-warren-presses-sec-to-investigate-trump-family-crypto-firm-for-potentially-misleading-investors","name":"banking.senate.gov","type":"other","archive_url":"https://web.archive.org/web/20260829143716/https://www.banking.senate.gov/newsroom/minority/ahead-of-crypto-markup-warren-presses-sec-to-investigate-trump-family-crypto-firm-for-potentially-misleading-investors","credibility":3,"archive_timestamp":"2026-08-29T14:37:16+00:00"},{"url":"https://www.cryptotimes.io/2026/05/15/senator-warren-urges-sec-to-probe-trump-backed-world-liberty-financial/","name":"cryptotimes.io","type":"other","archive_url":"http://web.archive.org/web/20260727103433/https://www.cryptotimes.io/2026/05/15/senator-warren-urges-sec-to-probe-trump-backed-world-liberty-financial/","credibility":3,"archive_timestamp":"2026-07-27T10:34:33+00:00"},{"url":"https://financefeeds.com/wlfi-leverage-position-pushes-dolomite-protocol-to-liquidity-limit/","name":"financefeeds.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://forum.arbitrum.foundation/t/tremendous-violation-of-stip-rules-by-dolomite-and-umami/19739","name":"forum.arbitrum.foundation","type":"other","archive_url":"https://web.archive.org/web/20260829133803/https://forum.arbitrum.foundation/t/tremendous-violation-of-stip-rules-by-dolomite-and-umami/19739","credibility":3,"archive_timestamp":"2026-08-29T13:38:03+00:00"},{"url":"https://forum.arbitrum.foundation/t/dolomite-final-stip-round-1/16818","name":"forum.arbitrum.foundation","type":"other","archive_url":"https://web.archive.org/web/20260829133709/https://forum.arbitrum.foundation/t/dolomite-final-stip-round-1/16818","credibility":3,"archive_timestamp":"2026-08-29T13:37:09+00:00"},{"url":"https://www.pcrisk.com/removal-guides/33668-dolomite-dolo-allocation-checker-scam","name":"pcrisk.com","type":"other","archive_url":"http://web.archive.org/web/20260607203841/https://www.pcrisk.com/removal-guides/33668-dolomite-dolo-allocation-checker-scam","credibility":3,"archive_timestamp":"2026-06-07T20:38:41+00:00"},{"url":"https://docs.dolomite.io/audits-and-security","name":"docs.dolomite.io","type":"other","archive_url":"http://web.archive.org/web/20260708061934/https://docs.dolomite.io/audits-and-security","credibility":3,"archive_timestamp":"2026-07-08T06:19:34+00:00"},{"url":"https://www.coingecko.com/en/coins/dolomite","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20250901012603/https://www.coingecko.com/en/coins/dolomite","credibility":3,"archive_timestamp":"2025-09-01T01:26:03+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:34.241084+00:00","updated_at":"2026-08-30T01:16:28.201949+00:00"}}